In local setting, we assume that the device is off-the-shelf and the attacker can do profiling on an identical device to train a predictor model. While the target application is running, the attacker can get access to the run-time hardware traces of the target neural network applications through side-channel attacks [1]}, [2]}, [3]}.
